---
id: CVE-2023-4535
title: >-
  Opensc: out-of-bounds read in myeid driver handling encryption using symmetric
  keys
summary: >-
  An out-of-bounds read vulnerability was found in OpenSC packages within the
  MyEID driver when handling symmetric key encryption. Exploiting this flaw
  requires an attacker to have physical access to the computer and a specially
  crafted US…
severity: medium
cvss: 4.5
cvssVector: 'CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-125
vendor: Red Hat
product: opensc
affected:
  - opensc (all versions)
  - opensc
  - opensc
published: '2023-11-06'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T05:01:53.232Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-4535'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:7879'
    label: 'RHSA-2023:7879'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-4535'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2240914'
    label: RHBZ#2240914
  - url: >-
      https://github.com/OpenSC/OpenSC/commit/f1993dc4e0b33050b8f72a3558ee88b24c4063b2
  - url: 'https://github.com/OpenSC/OpenSC/issues/2792#issuecomment-1674806651'
  - url: 'https://github.com/OpenSC/OpenSC/releases/tag/0.24.0-rc1'
  - url: 'https://github.com/OpenSC/OpenSC/wiki/OpenSC-security-advisories'
tags:
  - cve.org
epss: 0.00487
epssPercentile: 0.42187
ingestedAt: '2026-11-07T05:10:28.779Z'
---

## Overview

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.

## Affected

- `opensc (all versions)`
- `opensc`
- `opensc`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.